Traffic analytics
H/R Echo classifies likely humans and automation, records privacy-minimized request fingerprints, demand shape and verification status, and may retain an encrypted bot-origin IP for up to 24 hours solely for origin/network enrichment before erasing it. Full User-Agent strings are not stored by Echo. The hosting provider may maintain ordinary server access/security logs independently.
Payments
Card checkout is hosted by Stripe when configured. H/R stores payment identifiers, status and amounts needed for accounting and entitlements; it does not collect or store card numbers.
Admin
Admin uses a secure session cookie. Service credentials entered in Admin are encrypted at rest using a server-side application key.